package com.hnas.sys.core.util;

import java.util.Iterator;
import java.util.Map;
import java.util.ResourceBundle;

import com.hnas.core.util.StringUtil;


public class InjectKeyCheckUtils {

	/**
	 * SQL关键字

	 */
	private static String[] sqlKeys;

	/**
	 * 跨站关键字

	 */
	private static String[] injectKeys;
	private static String[] excludeValues;
	private static String[] validReferer;
	private static String parameterLess20;
	private static String parameterOver50;
	private static String parameterOver200;

	private static final ResourceBundle bundle = ResourceBundle
			.getBundle("ctx-component");

	static {
		String sqlKey = bundle.getString("inject.sqlkey");
		sqlKeys = sqlKey.toLowerCase().split(",");
		String injectKey = bundle.getString("inject.injectkey");
		injectKeys = injectKey.toLowerCase().split(", ");
		String excludeUrl = bundle.getString("inject.excludeUrls");
		excludeValues = excludeUrl.split(",");
		parameterLess20  = bundle.getString("maxLength.less20");
		parameterOver50  = bundle.getString("maxLength.over50");
		parameterOver200  = bundle.getString("maxLength.over255");
		validReferer = bundle.getString("inject.validReferer").split(",");
	}

	@SuppressWarnings("unchecked")
	public static boolean hasInjectKeys(Map parameters, boolean backend) {

		boolean result = false;
		if (parameters != null && parameters.size() > 0) {
//			boolean backend = false;
			for (Iterator iter = parameters.keySet().iterator(); iter.hasNext();) {
				String key = (String) iter.next();
				String[] values = (String[]) parameters.get(key);
				for (int i = 0; i < values.length; i++) {
					// Only when length is greater than 15
					// url encoding,,,
					String inputValue = values[i];
				
					//if (inputValue.length() > 15) {
						// contain inject key words
					if (!StringUtil.isEmpty(inputValue) && hasInjectionKey(inputValue,backend))
						return true;

				}
			}
		}

		return result;

	}
	public static boolean hasInjectionKey(String inputValue, boolean backend){
		for (int j = 0; j < sqlKeys.length; j++) {
			
			String checkKey=" "+sqlKeys[j]+" ";
			String checkKey2="%20"+sqlKeys[j]+"%20";
			if (inputValue.toLowerCase().indexOf(checkKey) > -1 || inputValue.toLowerCase().indexOf(checkKey2) > -1) {
				return true;
			}
		}
	//}
//		boolean backend = true;
	//injectKey ... if contain then reject
	for (int j = 0; j < injectKeys.length; j++) {
		if (backend && injectKeys[j].equals("@"))
			continue;
		if (backend && injectKeys[j].equals("&"))
			continue;
		if (inputValue.toLowerCase().indexOf(injectKeys[j]) > -1) {
			return true;
		}
	}
		return false;
	}
	public static boolean isExcludeUrls(String url){
		boolean result = false;
		for (int i = 0; i < excludeValues.length; i++) {
			if (url.indexOf(excludeValues[i]) > -1) {
				return true;
			}
		}
		return result;
//		return false;
	}
	public static boolean isValidRefer(String refer){
		for (int i = 0; i <validReferer.length; i++) {
			if (refer.indexOf(validReferer[i]) >=0) {
				return true;
			}
		}
		return false;
		
	}
	public static boolean isOverLength(String parameter, int length){
		if (parameter.endsWith("dtoAddress.address")){
			if (length>200)
				return true;
			else
				return false;
		}
		else if (length>200 && parameterOver200.indexOf(parameter)<0)
			return true;
		else if (length>50 && (parameterOver50 +parameterOver200).indexOf(parameter)<0)
			return true;
		else if (length>20 && (parameterLess20).indexOf(parameter)>=0)//<20
			return true;
		return false;
	}
}
